CVE-2017-12364

published 2017-11-30

CVE-2017-12364: A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized…

Priority P3 40 medium 6.5 CVSS 3.0

AV N AC L PR N UI N S U C L I L A N

A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized Structured Query Language (SQL) queries. The vulnerability is due to a failure to validate user-supplied input that is used in SQL queries. An attacker could exploit this vulnerability by sending a crafted SQL statement to an affected system. Successful exploitation could allow the attacker to read entries in some database tables. Cisco Bug IDs: CSCvg30333.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
cisco	prime_service_catalog	—	—
cisco	prime_service_catalog	—	—
cisco	prime_service_catalog	—	—
cisco	prime_service_catalog	—	—

CVSS provenance

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:P/I:P/A:N

vendor_cisco 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89